tracking threat actors through yara rules and … · tracking threat actors through yara rules and...

Tracking Threat Actors through YARA

Rules and Virus Total

Kevin Perlow- Booz Allen HamiltonAllen Swackhamer- Target Corporation

YARA Rule Notification

Elasticsearch Stack Indexing/Logging

Cuckoo

Additional APIs

1

2

3

24

Automation and Collection Workflow

YARA Rules - Purpose• Track Campaigns

▫ Strings

▫ Static Indicators

▫ Compilation Artifacts

▫ Opcode signatures

• Categorize Malware

▫ Family / Variants Basic YARA rule for tracking a crimeware crypter

YARA Rules- Examples

YARA Rules- Examples

YARA Rules- Examples

YARA Rules- Case Study

YARA Rules- Case Study

Left: the executable path being built.

Top right: Similar sample- the GET request being made inside a try/catch function

YARA Rule Notification

Elasticsearch Stack Indexing/Logging

Cuckoo

Additional APIs

1

2

3

24

Automation and Collection Workflow

Notifications API

• VirusTotal or proprietary database

▫ SMTP notifications

Pull via Python IMAP library

▫ JSON notifications

Pull from REST API via Python requests library

Delete the alerts from VT after you process them

• Index and Parse into Elasticsearch

Sample VirusTotal Notification

IOC Extraction and Logging• Static Extraction

▫ Configuration deobfuscation and parsing▫ Strings▫ Various obfuscation techniques (olevba)▫ FLOSS – Automated deobfuscation of strings

• Dynamic Extraction▫ Sandbox

Network File system

YARA Rule Notification

Elasticsearch Stack Indexing/Logging

Cuckoo

Additional APIs

1

2

3

24

Automation and Collection Workflow

Elasticsearch Stack• Elasticsearch & Kibana

▫ Visualize Notification Trends First Seen Last Seen Resubmissions

▫ Export Data (Hash, Rule Name, Rule Set) Pivot through additional API’s Export to CSV/JSON or other consumable formats

Cuckoo Sandbox• Automated Submission

▫ Push notifications to Cuckoo on ingest from VT▫ Output IOCs (Domains, Files, Mutexs, etc…) back to

Elasticsearch• Customizable

▫ Custom Elasticsearch reporting module• Popular Sandboxes

▫ VirusTotal▫ Malwr▫ Hybrid Analysis

• Sets shard count to 1

• Compression to “best”

• Strings to “not_analyzed”

• task_id is an indexed field

• report_time is the date/time field

Cuckoo Elasticsearch

Index Template

Back to the Elasticsearch Stack

• Collect Cuckoo IOCs

▫ Track by Domain, IP, Country

▫ Files written to disk

▫ Command line called

▫ Normalization of A/V Data

• Files• Registry• Mutex• Directory• Resolved Hosts• Connected Hosts• Command Line• DLL Loaded• WMI Query• Target File - Hash• Target File - Name• Target File - Type• VirusTotal Signatures

Cuckoo Summary

Lucene Search Query Syntax

List of hosts and files written aggregated with count

Normalized AV signatures from VT

Command line called by malware

File size and hosts connected to

YARA Rule Notification

Elasticsearch Stack Indexing/Logging

Cuckoo

Additional APIs

1

2

3

24

Automation and Collection Workflow

Additional APIs• VirusTotal

▫ Parent objects Emails Zip Files

▫ Network Infrastructure• CentralOps

▫ Whois▫ Physical Address

• PassiveTotal▫ PassiveDNS▫ Historical Records

Recap• Built YARA rule for one dropper

• Identified 700+ files

• Automated analysis via Cuckoo

• Logging via Elasticsearch and Visualization with Kibana

• Additional pivoting via API

• Source code: https://github.com/swackhamer

Questions?